ZSPACE Z4Pro+ Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the ZSPACE Z4Pro+ NAS device running firmware version 1.0.0440024. The issue arises in the HTTP POST request handler for the '/v2/file/safe/close' endpoint, where the 'zfilev2_api_CloseSafe' function is executed. This vulnerability allows remote attackers to inject and execute arbitrary commands on the affected device, with the potential to gain root privileges and full control over the NAS.

Impact

Exploitation of this vulnerability leads to remote command execution on the affected device, with the attacker gaining root privileges.

Reproduction

To reproduce this vulnerability, send a POST request to the '/v2/file/safe/close' endpoint with a 'safe_dir' parameter that includes a crafted payload. The payload should be designed to exploit the command injection vulnerability by injecting a command that will be executed on the device.